# 188-all-sites.conf.j2
# AWOOOI 188 public gateway baseline managed by infra/ansible/playbooks/nginx-sync.yml.
# 2026-05-29 Codex: synced from live 188 after reboot recovery; aiops.wooo.work
# must use the K3s VIP 192.168.0.125:32334/32335 instead of a single 120 node.
#
# =============================================================================
# AIOPS - aiops.wooo.work
# =============================================================================
server {
    listen 80;
    server_name aiops.wooo.work;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name aiops.wooo.work;

    ssl_certificate /etc/letsencrypt/live/aiops.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/aiops.wooo.work/privkey.pem;

    # API
    location /api/ {
        proxy_pass http://192.168.0.125:32334/api/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # WebSocket
    location /api/v1/ws {
        proxy_pass http://192.168.0.125:32334/api/v1/ws;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }

    # Frontend
    location / {
        proxy_pass http://192.168.0.125:32335;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# =============================================================================
# GitLab - gitlab.wooo.work (代理到 110)
# =============================================================================
server {
    listen 80;
    server_name gitlab.wooo.work;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name gitlab.wooo.work;

    ssl_certificate /etc/letsencrypt/live/gitlab.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/gitlab.wooo.work/privkey.pem;

    client_max_body_size 500m;

    location / {
        proxy_pass http://192.168.0.110:8929;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        proxy_connect_timeout 300s;
    }
}

# =============================================================================
# SigNoz - signoz.wooo.work
# =============================================================================
server {
    listen 80;
    server_name signoz.wooo.work;

    location / {
        proxy_pass http://127.0.0.1:3301;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# =============================================================================
# Tsenyang - www.tsenyang.com (待遷移，暫時代理到 110)
# =============================================================================
server {
    listen 80;
    server_name www.tsenyang.com tsenyang.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name www.tsenyang.com tsenyang.com;

    ssl_certificate /etc/letsencrypt/live/www.tsenyang.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.tsenyang.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# =============================================================================
# Stock Platform - stock.wooo.work
# =============================================================================
server {
    listen 80;
    server_name stock.wooo.work;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name stock.wooo.work;

    ssl_certificate /etc/letsencrypt/live/stock.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/stock.wooo.work/privkey.pem;

    # 後台直接接收，不經由網站主站 Basic Auth
    location = /admin {
        return 301 /admin/;
    }

    location /admin/ {
        auth_basic off;
        proxy_pass http://192.168.0.110:31235;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
    }

    # 前台主站
    location / {
        proxy_pass http://192.168.0.110:31235;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# =============================================================================
# MOMO PRO - mo.wooo.work (待部署)
# =============================================================================
server {
    listen 80;
    server_name mo.wooo.work;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name mo.wooo.work;

    ssl_certificate /etc/letsencrypt/live/mo.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mo.wooo.work/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:5003;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 300s;
    }
}

# =============================================================================
# Bitan 藥局 - bitan.wooo.work (待部署)
# =============================================================================
server {
    listen 80;
    server_name bitan.wooo.work;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name bitan.wooo.work;

    ssl_certificate /etc/letsencrypt/live/bitan.wooo.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bitan.wooo.work/privkey.pem;

    client_max_body_size 25m;

    location / {
        proxy_pass http://192.168.0.110:3003;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# =============================================================================
# VTuber - vtuber.wooo.work
# =============================================================================
server {
    server_name vtuber.wooo.work;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        proxy_pass https://192.168.0.110;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/vtuber.wooo.work/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/vtuber.wooo.work/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = vtuber.wooo.work) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name vtuber.wooo.work;
    return 404; # managed by Certbot


}
